I'm sorry for my bad English. I'm a beginner in Reverse Engineering. I have a problem like this. I was given two files, one is driver's .inf file and the other is driver's .sys file. My mission is to debug this driver and understand its functionality(driver doesn't have physical device). I use 2 machines, one is the host machine which is actually my real computer and a XP virtual machine(VMware). I also use VirtualKD and Windbg. I want to set breakpoint at its DriverEntry.
When I installed driver, I noticed that it ran automatically right after being installed. So I can't set breakpoint at DriverEntry. I restarted virtual machine and set breakpoint in Windbg with all the following commands:
bu Driver!DriverEntry (Driver is driver's ClassName, I saw it in .inf file)
bu Drv!DriverEntry (Drv is its service name when installed)
bu drv!DriverEntry (drv is sys file name, drv.sys)
But Windbg didn't catch any breakpoints. I saw Windbg printed out some infos, I don't know whether it made breakpoints could not catch:
* * A driver is mapping physical memory 0064F000->006D0FFF * that it does not own. This can cause internal CPU corruption. * A checked build will stop in the kernel debugger * so this problem can be fully debugged. *
ERROR: DavReadRegistryValues/RegQueryValueExW(4). WStatus = 5 ERROR: DavReadRegistryValues/RegQueryValueExW(5). WStatus = 5 ERROR: DavReadRegistryValues/RegQueryValueExW(6). WStatus = 5 CodeSet_Init: no ICU watchdog!WdUpdateRecoveryState: Recovery enabled.
My second thought was I rolled back my virtual machine and set breakpoints before installing driver. But Windbg said that it could not resolve those breakpoints. And of course it cannot hit any of them.
I really don't know how to set this driver's entry. Please help me. Thank you.
P/S: probably this driver can communicate with other app through pipe. How can I debug it without infecting its communication?